feat(prototype): keep /prototype:pressure-test evidence on a throwaway branch after the repository's secrets check #12026

Parent #7591 records the decision "prototype evidence on a throwaway branch after the secrets check" (Q167, Q168), but its lane run stopped with reason intent (comment 6556369883), partly because that conflicts with rule 6 ("Delete or absorb when done") at plugins/prototype/context/discipline.md:37 and because the issue tied the check to the Dossier thread. The poteto-review ledger records the owner's answer to Q168 as "accepted as recommended audit A7" (.work/poteto-review/interview-checklist.md:213), and decision row 99 records Q160 and Q165-Q169 as "APPROVED as recommended" (.work/poteto-review/GUIDE.md:209, owner 2026-10-15). The session's question and recommendation the owner accepted (.work/poteto-review/deepdive/ROUND.md:301-303), verbatim, are: "Q168: Should a prototype's evidence be kept by pushing it to a throwaway branch and citing branch and SHA in its note, with the push run only after the repository's secrets and machine-data check passes?" and "Yes: push only after the check passes, else record the local path and "not pushed: "; /planning:plan lists prototype evidence and what stays unproven." The check is the repository's own secrets and machine-data check, as Q168's accepted text puts it (ROUND.md:301), so this slice adds no new check. When the source-control pre-push secrets step from #7579 / #10150 is present, it is that check.

Done when

• plugins/prototype/context/discipline.md's "When done" section defines an evidence step, run after the durable note is written and before the throwaway code is deleted, and plugins/prototype/skills/pressure-test/SKILL.md step 5 runs it by pointing at that section. The step:
  • runs the repository's own secrets and machine-data check over the prototype files;
  • names the branch by the consumer repository's own declared branch-naming convention, never a default-branch or lane-reserved name, and states the name it used in the note;
  • pushes the files to that throwaway branch, never the default branch, only when the check passes, and writes the branch name and commit SHA into the durable note;
  • pushes nothing when the repository has no such check or the check fails, and writes the local path and not pushed: <reason> into the note instead.
• plugins/prototype/context/discipline.md names this as an exception to rule 6: the shell still leaves the working tree, and a pushed branch holds the evidence only when the check passed.
• The rejection clause in the prototype row of docs/upstream/mattpocock-skills.md (:52 on main) is replaced. The new text says the evidence branch is adopted after the repository's check and cites Q168.
• The prototype entry in docs/upstream/mattpocock-skills.md's per-skill summary (:316 on main) no longer says the branch capture was rejected. It says the evidence branch is adopted after the repository's check (Q168).
• plugins/prototype/evals/ gains a case whose case.yaml uses the same schema_version as pt-html-demo-offline/case.yaml. Its scaffold has no secrets check, and its expected_outcome states that nothing is pushed and that the note records the local path and not pushed: <reason>.
• A .changes/prototype/*.md fragment with bump: minor describes the step.
• The PR's CI is green.

Out of scope

• /planning:plan listing prototype evidence and what stays unproven (slice S5).
• A new or shared secrets check, including one for the Dossier thread.

Related

• source-control: dossier branches per owning item #7579 and source-control: dossier branches per owning item - part 2 of 2 #10150: the source-control pre-push secrets step.
• Concise skills rollout: prototype (2 skills, 2 model-invoked) #6589 rewrites the prototype skills.

Parent: #7591